451 RESEARCH REPRINT

R E P O RT R E P R I N T

TITUS changes tack, places big

bet on machine-learning-based
classification
GA R RETT BEK KER
0 9 N OV 20 1 8
In a massive shift in both vision and strategy, Canadian vendor TITUS has introduced machine-learning-based classifica-
tion that is intended to greatly reduce the reliance on its flagship user-based classification technology.

THIS REPORT, LICENSED TO TITUS, DEVELOPED AND AS PROVIDED BY 451 RESEARCH, LLC, WAS
PUBLISHED AS PART OF OUR SYNDICATED MARKET INSIGHT SUBSCRIPTION SERVICE. IT SHALL BE
OWNED IN ITS ENTIRETY BY 451 RESEARCH, LLC. THIS REPORT IS SOLELY INTENDED FOR USE BY
THE RECIPIENT AND MAY NOT BE REPRODUCED OR RE-POSTED, IN WHOLE OR IN PART, BY THE RE-
CIPIENT WITHOUT EXPRESS PERMISSION FROM 451 RESEARCH.

©2018 451 Research, LLC | W W W . 4 5 1 R E S E A R C H . C O M

 451 RESEARCH REPRINT

TITUS has been best known for providing user-based classification for unstructured data, primarily
within Microsoft’s Office franchise, although in recent years the Ottawa-based vendor has expanded
its capabilities to address cloud applications, such as Box, Dropbox and OneDrive; support for desktop
and Mac versions of Office 365; and online versions of Outlook and Google G-Suite. Its most recent
development represents a tectonic shift in both philosophy and architecture, with the introduction
of machine learning classification capabilities that are intended to greatly reduce the reliance on user-
based classification.

T H E 4 5 1 TA K E
Despite potential advantages in protecting against data breaches, data security (in general) remains
less widely deployed and receives less funding than other areas of security, such as network or end-
point security tools. In our view, one of the primary reasons for this is that data security can be com-
plex, and often places a burden on users in terms of changes to workflows and the overall user expe-
rience. This is one of the biggest potential drawbacks to data classification, particularly user-based
approaches. Thus, we applaud TITUS’s decision to introduce machine-learning-based classification to
its arsenal, which should reduce friction for end users and improve on the accuracy of prior attempts
at automated classification. We anticipate the move to be just the first of several new initiatives under
the stewardship of new PE owner Blackstone, and would not be surprised to see TITUS enter the M&A
arena for the first time in its 13-year history to expand beyond data classification into adjacent areas of
the data protection ecosystem, such as rights management.

CONTEXT
Ottawa-based TITUS was cofounded in 2005 by CEO Tim Upton, CTO Stephane Charbonneau and VP of mobile so-
lutions Charlie Pulfer. The company started out selling mainly to government and defense customers in Australia
and the US, including NATO, the US Department of Veterans Affairs and the US Air Force, and eventually expanded
into large enterprises such as Dow Corning, Nokia and Dell. In December 2017, the company sold a majority stake
to private equity firm Blackstone for an undisclosed sum, completing a rare journey from bootstrapped to buyout
without raising any venture capital.

PRODUCTS
TITUS has been best known for its user-based classification capabilities for on-premises unstructured data, such
as emails, documents and files. In 2014, the company addressed mobile use cases with TITUS Classification for
Mobile and made its first foray into addressing cloud applications, such as Box, Dropbox and Microsoft OneDrive.
TITUS Illuminate, released in February 2016, added data discovery features, with the ability to do full searches of
on-premises file shares and cloud applications, such as SharePoint Online, OneDrive, Box and Dropbox for PII, as
well as other confidential information. Earlier in 2018, TITUS extended its spectrum of classification to address all
flavors of Microsoft Outlook – both hosted and on-prem.
The newest change to the TITUS lineup is the addition of machine-learning-based classification with the launch
of TITUS Intelligent Protection (TIP), which represents a massive shift away from TITUS’s historical reliance on us-
er-based classification. While user-based classification has historically been more accurate than automated ap-
proaches, it also places a significant burden on end users. More generally, the potential for complexity and an
adverse impact on the user experience is one of the main reasons why data protection has historically been less
widely deployed than other security approaches, such as network security and endpoint security.
The main goals of TIP are to increase the confidence level of classifications to allow for more real-time policy de-
cisions, and to reduce the burden on end users by relying more on automation. Automated classification based
on Regular Expression (RegEx) searches or keywords works well with well-formatted data, such as credit card
or social security numbers, but less so for other types of PII. TITUS Intelligent Protection will rely on a machine
 451 RESEARCH REPRINT

learning engine to analyze the entirety of words and phrases in documents to help categorize documents into
certain types, such as press releases or product documentation, even without developing a formal classification
taxonomy. These categorizations can be used by customers as a first step to get a quick handle on what types of
data they have, and in a sense can be thought of as preprocessing or grouping prior to more traditional classifica-
tion attempts to build up a corpus of data types.
Once data is tagged, the classification will travel with the data, which in theory will allow for more accurate
policy decisions made by DLP, rights management or even CASB offerings. The output of the initial scan can be
used to drive real-time policy responses, or to perform ‘suggested classifications’ to help supplement user-based
classifications.

S T R AT E G Y
Under the Blackstone umbrella, TITUS is trying to tell a broader data protection story that goes beyond just classifi-
cation. Future strategic investments will focus on five key areas: policy extensibility to extend TITUS’s classification
capabilities to third-party applications; machine learning to help increase the confidence of classifications and
drive more automation; data-at-rest security via TITUS Illuminate; more service-based/SaaS offerings of TITUS’s ca-
pabilities; and rights management, which is a highly fragmented area dominated by mainly smaller niche vendors
(aside from Microsoft Information Protection).
The ultimate goal of leveraging machine learning is to greatly reduce the need for user involvement – TITUS aims
to reduce the need for user input to 10-20% of overall classification events. Further areas of investment by TITUS
will likely include other techniques, such as natural language processing (NLP) and deep learning, to be able to
identify full names and addresses for GDPR and other compliance mandates, which currently is nontrivial.
In terms of pricing, the machine learning capabilities will be included as part of the basic TITUS bundle of services
once TITUS revamps its overall pricing strategy. However, for customers that have TITUS today, there will be an
add-on SKU.

COMPETITION
Viewed strictly through the data classification lens, TITUS’s primary competition would include pure plays such
as Boldon James, Spirion (fka Identity Finder) and Ground Labs. However, recent M&A activity has brought in IT
heavyweights such as Microsoft (via the Secure Islands acquisition) and Symantec (via the Watchful Software pur-
chase). The latter may combine classification with other features, such as information rights management, data
discovery, encryption, DLP and CASB.
Many DLP vendors also have their own data discovery and classification capabilities, although most lack the full
complement of classification techniques that TITUS offers. Viewed more broadly as a data security vendor with
some rights management and DLP capabilities, TITUS could also compete for budget dollars with DLP vendors
such as Digital Guardian, Clearswift, GTB Technologies, CoSoSys, Forcepoint, McAfee and Symantec. Rights man-
agement vendors such as Ionic Security, Seclore, Vera and Virtru are more adjacent and complementary than
directly competitive.
 451 RESEARCH REPRINT
SWOT A NA LYS I S
ST R E N GT H S
Adding machine learning to reduce the de-
mands of user-based classification is a logi-
cal move that will need to be matched by
competitors.
O P P O RT U N I T I E S
With Blackstone’s backing, we would not be
surprised to see TITUS address adjacent
areas of data security – either organically
or via M&A – such as DLP and data access
governance, or move deeper into rights
management.
WEAKNESSES
TITUS is still mainly about ‘keeping honest
users honest’ – accidental data leakage by
nonmalicious insiders is still the company’s
primary use case. Customers will still need to
rely on third parties or partners for protec-
tion from malicious users via DLP, encryption
or other next-gen methods.
T H R E ATS
Sleeping with an elephant can always be dan-
gerous – no matter how well you get along,
there’s always the chance you could be
crushed. TITUS will need to continue to walk
a fine ‘coopetition line’ to avoid running afoul
of longtime ‘frenemy’ Microsoft.